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Address Books 



Email address books for most major webmail are collected as 
stand-alone sessions (no content present*) 

Address books are repetitive, large, and metadata-rich 

Data is stored multiple times (marina/mainway, pinwale, clouds) 

Fewer and fewer address books attributable to users, targets 

Address books account for ~ 22% of SSO’s major accesses (up 
from ~ 12% in August) 



'Access (10 Jan 12) 


Total Sessions 


Address Books 


" Provider 


Collected 


Attributed 


Attributed% 


US-3171 


1488453 


237067 (16% of traffic) 


Yahoo 


444743 


11009 


2.48% 


DS-200B 


938378 


311113 (33% of traffic) 


Hotmail 


105068 


1115 


1.06% 


US-3261 


94132 


2477 (3% of traffic) 


Gmail 


33697 


2350 


6.97% 


US-3145 


177663 


29336 (16% of traffic) 


Face book 


82857 


79437 


95.87% 


US-3180 


269794 


40409 (15% of traffic) 


Other 


22881 


1175 


5.14% 


US-3180 (16 Dec 11) 
TOTAL 


289318 

3257738 


91964 (32% of traffic) 
712366 (22% of traffic) 


TOTAL 


689246 


95086 


13.80% 
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Serendipity - 
New Protocols 




|@hotioMJ3iO. tflhat was your first- phone numberU. 
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Serendipity - HTTP Demux 



**eoc2c 

GU0XlHdS/4k8YUAcliiPGd/Nvr iOvYalboluzcaFdZcyf pHeg9rFTIyts jXoUyZnngI417JMAJHZ9M9ZXYwZU9qxvBwOLKZGBYlsvC43 iUBvCrf 4elcP2Pxs35+L 
Cache-Control: no-cache 

POST / gateway/ gateway . dll?Action=pollSLif espan=60£SessionID=8682 16649 . 1709645966 HTTP/ 1 . 1 
Host : baymsgl030124 . gateway .messenger . live . com 

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:14.0) Gecko/20100101 Firefox/14 
Accept : text/html, applicat ion/xhtml+xml, application/ xml; q=0 .9, */ *; q=0 . 8 
Accept-Language : en-us, en; q=0 . 5 
Accept-Encoding: gzip, deflate 
Connection: keep-alive 

X-Requested-Session-Content-Type : text/html 
Content-Type: text/html; charset=utf-8 
Pragma: No-Cache, no-cache 
X-HSN-Auth: Use-Cookie 

Ref erer : http : //baymsgl030124 . gateway .messenger . live . com/xmlProxy . htm?vn=9 . 090515 . 06domain=live . com 
Content-Length: 0 

Cookie : wlidperf =latency=14338£throughput=0; mktO=en-AF; wla42=cHJveHktYmF5LnB2dCljb250YUN0cy5tc24uY29tf GJ5MSoxLDgzMTYzNj I1N 
Cache-Control: no-cache 
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Print Notes 



http://www.documentcloud.org/notes/print?docs[]=841654 



Evidence of Microsoft's vulnerability 

3 Pages - Contributed by Matt DeLong, Washington Post - Nov 25, 2013 

These slides suggest, without offering definitive proof, that National Security Agency programs targeting Google and Yahoo for 
collection also had Microsoft in their sights. 



Hotmail address books collected (p. 1) 



' Provider 


Collected 


Attributed 


Attributed* 


Vihoo 


444743 


11009 


2.48* 


Hoimjii 


ioso** 


11 IS 


106% 


Gmail 


33697 


2350 


6.97% 


fat ebook 


87*57 


79437 


9S.S7* 


Other 


22381 


UTS 


5.14* 


TOTAL 


6*9246 


950*6 


13 80% 



A reference to a Hotmail message (p. 2) 



i. .a. 
3.0. s. 



. 3 .. 



photalUSlO . Uhit vas your hrft phone nuaberU. 
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An instant message from Windows Live Messenger (p. 3) 
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■0*4 9 
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